v4.12.0-next.internal.1

• : NONE (by @sowmyav27 in #7168)
• : NONE (by @roehrijn in #7210)
• : NONE (by @roehrijn in #7549)
• bugfix: Fix invalid release workflow caused by missing pull-requests permission on the e2e-ginkgo caller. (by @sowmyav27 in #7572)
• bugfix: Fix node environment teardown getting stuck when the OpenTofu workspace was already deleted. (by @seanschneeweiss in #7304)
• bugfix: Fixed Grafana SSO for the default platform admin and any user without an email set, who previously could not sign in to the Fleet Observability Grafana. (by @johannesfrey in #7480)
• bugfix: Fixed a race in the access-keys controller that could permanently delete a freshly-created login access key before its owning user was observed by the controller's cache, causing login failures. (by @roehrijn in #7429)
• bugfix: Fixed an issue where a NetworkPeer deletion during a brief coordinator API connection loss left a stale (ghost) peer in connected clients netmaps, which could break vCluster-to-vCluster connectivity (for example the resource proxy) until the affected vCluster was restarted. (by @rlmcpherson in #7616)
• bugfix: Fixed an issue where deleting a user or team could remove the owner (and owner access) of projects and other resources owned by unrelated users or teams. (by @roehrijn in #7136)
• bugfix: Fixed kubeconfig generation not normalizing the scheme of a user-supplied server value, and fixed the client-certificate guard incorrectly rejecting scheme-qualified access-point/direct-endpoint server URLs. (by @r0bnet in #7484)
• bugfix: Fixed the Fleet Observability Grafana and Prometheus apps hardcoding the loft namespace, which broke pod startup, SSO login, and OIDC token exchange on platforms not installed in loft. The deploy namespace is now a configurable destinationNamespace parameter. (by @johannesfrey in #7456)
• bugfix: Fleet Observability no longer nests the entire platform UI in the dashboard iframe when the linked Grafana is not served from the /grafana/ sub-path; a configuration error page is shown instead. (by @seanschneeweiss in #7577)
• bugfix: Pre-release upgrade checks (Platform) now resolve the vcluster upgrade-version correctly when the platform base's DefaultVClusterVersion already equals the latest vcluster-pro GA, and no longer pick a release candidate as the upgrade target due to sort -V not honoring SemVer pre-release ordering. (by @sowmyav27 in #7192)
• bugfix: Stop the Fleet Observability Prometheus backend from emitting continuous TLS handshake errors by disabling the config-reload sidecar that cannot speak mTLS and tuning its health probes. (by @johannesfrey in #7489)
• bugfix: The platform's loft-router client now uses exponential backoff with jitter, a per-instance reconnect rate cap, and a circuit breaker, so an unhealthy or crash-looping instance no longer floods a shared regional router with reconnect attempts. (by @Piotr1215 in #7556)
• bugfix: Tolerate a trailing slash in the Fleet Observability Grafana platformHost (by @johannesfrey in #7524)
• deprecation: The API for moving virtual cluster instances between projects (projects.management.loft.sh/migratevirtualclusterinstance) is deprecated and will be removed in a future release. (by @seanschneeweiss in #7276)
• enhacement: OIDC token exchange endpoint can support ADFS access_token_issuer non-standard behavior when "LOFT_OIDC_TRUST_ACCESS_TOKEN_ISSUER=true" env var is set. (by @matskiv in #7299)
• enhancement: Improve metal3 UX (by @squ94wk in #7445)
• enhancement: Minor UX improvements to vMetal (by @squ94wk in #7511)
• enhancement: Run the pr-labelled e2e Ginkgo suite against each published release tag to certify the release. (by @sowmyav27 in #7290)
• enhancement: vCluster Platform's managemet.loft.sh API now supports ValidatingAdmissionPolicy resources (by @matskiv in #7300)
• feature: Add forwardTokenMode (Off/TokenReview/Passthrough) for tenant clusters. Passthrough forwards the caller's token directly to the tenant cluster's API server without a TokenReview or impersonation. The forwardToken boolean is deprecated but still honored. (by @lizardruss in #7191)
• feature: Add metrics-reader and metrics-writer access-key scope roles for the upcoming monitoring gateway. Scoped access keys now have their SelfSubjectAccessReview responses re-checked against the key's per-cluster scope, so a self review never reports more access than the key can actually exercise. The default loft-management-admin role grants metricsread on clusters and virtual cluster instances; per-instance metrics reads for project members are gated through each instance's owner access. (by @johannesfrey in #7108)
• feature: Adds Collector ArgoCD Template for Fleet Observability (by @seanschneeweiss in #7295)
• feature: Argo CD Template for installing the Fleet Observability metrics backend. (by @seanschneeweiss in #7294)
• feature: Introducing Fleet Observability for platform wide overview on tenant clusters. (by @seanschneeweiss in #7291)
• feature: Metal3 Netris integration (by @squ94wk in #7569)
• fix: Fix clean up of NodeClaim with non-existent NodeEnvironment (by @squ94wk in #7608)
• fix: Improve cluster overview usage view toggle labels, prevent node claims status column clipping on resize, and fix tenant cluster API client paths to use the project-scoped virtualcluster route. (by @andyluak in #7109)
• ui: Add redirect to virtual machines list if vm is deleted on details page (by @PRTTMPRPHT in #7229)
• ui: Added "no actions" context menu for empty items in VM graph (by @PRTTMPRPHT in #7242)
• ui: Added clear button for certificate secret names in observability form (by @PRTTMPRPHT in #7516)
• ui: Added contextual docs links to breadcrumb (by @PRTTMPRPHT in #7075)
• ui: Added graph view in virtual machine details (by @PRTTMPRPHT in #7196)
• ui: Added loading spinner to pod logs when the pod is still starting (by @PRTTMPRPHT in #7424)
• ui: Added separate power status tracking for BMHs (by @PRTTMPRPHT in #7056)
• ui: Added validation against missing node pools when creating auto nodes clusters (by @PRTTMPRPHT in #7053)
• ui: Added validation to namespace field in global secrets (by @PRTTMPRPHT in #7663)
• ui: Applied new header style across all main pages (by @PRTTMPRPHT in #7110)
• ui: Change navigation to group some pages and free space in the sidebar (by @PRTTMPRPHT in #7645)
• ui: Changed all "CRD" labels to read "CR" (by @PRTTMPRPHT in #7655)
• ui: Changed host cluster drilldown to match established drilldown styles (by @PRTTMPRPHT in #7225)
• ui: Ensured auto-generated access rule is disabled in tenant cluster configuration (by @PRTTMPRPHT in #7422)
• ui: Fix 404 errors being logged on the details page of a stopped kubevirt VM (by @PRTTMPRPHT in #7446)
• ui: Fixed actions availability for virtual machines (by @PRTTMPRPHT in #7234)
• ui: Fixed app readme taking up too much horizontal space (by @PRTTMPRPHT in #7650)
• ui: Fixed application of default tooltips to status badges to correct positioning (by @PRTTMPRPHT in #7392)
• ui: Fixed capitalization in "Show YAML" items (by @PRTTMPRPHT in #7646)
• ui: Fixed capitalization of VPN table headers (by @PRTTMPRPHT in #7163)
• ui: Fixed detection of error state for KubeVirt data volumes (by @PRTTMPRPHT in #7235)
• ui: Fixed hover state for user row in sidebar (by @PRTTMPRPHT in #7164)
• ui: Fixed infinite loading state of nodes table for pending tenant cluster (by @PRTTMPRPHT in #7565)
• ui: Fixed missing active state on more dropdown in the sidebar (by @PRTTMPRPHT in #7614)
• ui: Fixed permission checks in get started section of status page (by @PRTTMPRPHT in #7555)
• ui: Fixed permissions for tenant cluster instance actions (by @PRTTMPRPHT in #7551)
• ui: Fixed some minor display issues in cluster details view (by @PRTTMPRPHT in #7554)
• ui: Fixed trial indicator appearance when primary color is the same as background color (by @PRTTMPRPHT in #7652)
• ui: Fixed visibility of sidebar actions to treat sidebar focus correctly (by @PRTTMPRPHT in #7612)
• ui: Made template names wrap in template marketplace (by @PRTTMPRPHT in #7159)
• ui: Moved cron tooltip into description for snapshots (by @PRTTMPRPHT in #7661)
• ui: Removed template entry from tenant cluster header (by @PRTTMPRPHT in #7184)
• ui: Replaced deprecrated query lib call in CreateCustomClientDialog (by @PRTTMPRPHT in #7656)
• ui: Revamped tenant cluster status page (by @PRTTMPRPHT in #7040)